Well... isn't this interesting... I tried to find a reliable SHA-256 endpoint to test against. Pretty much everything I tried went to MD5. So I wrote my own that I could restrict to a specific hash algorithm, and lo! and behold! I found a bug in the digest-fetch package... if it attempts auth with an algorithm and the server responds with a different algorithm (i.e. what it supports/prefers), it simply re-issues the same request with the prior algorithm rather than trying the server's suggested algorithm. Mind you, this package has been like this for years (like maybe 2019?), and the last big check-in for the package was three years ago and not about this.
So quick and dirty, I wrote a wrapper around it to do the right thing, and it should properly support SHA-256, SHA-512-256, and MD5 (in that order of preference for now). That will be in the next build (soon).
Edit: the fix for this issue was made in build 26143.